On Tue, Dec 17, 2019 at 01:00:27AM +0000, Sargun Dhillon wrote: > This sample adds the usage of SECCOMP_RET_USER_NOTIF together with pidfd > GETFD ioctl. It shows trapping a syscall, and handling it by extracting > the FD into the parent process without stopping the child process. > Although, in this example, there's no explicit policy separation in > the two processes, it can be generalized into the example of a transparent > proxy. > > Signed-off-by: Sargun Dhillon <sargun@xxxxxxxxx> > --- > samples/seccomp/.gitignore | 1 + > samples/seccomp/Makefile | 9 +- > samples/seccomp/user-trap-pidfd.c | 190 ++++++++++++++++++++++++++++++ This is a great sample. Could you please also add tests without seccomp to the pidfd-testsuite itself under tools/testing/selftests/pidfd. I want to have all pidfd features tested in one place so that people don't need to run seccomp-bpf, or compile the optional samples but can just run the pidfd test-suite and it'll bang on all features. Christian
